src/libcharon/sa/ikev2/tasks/child_create.c

   1 /*
   2  * Copyright (C) 2008 Tobias Brunner
   3  * Copyright (C) 2005-2008 Martin Willi
   4  * Copyright (C) 2005 Jan Hutter
   5  * Hochschule fuer Technik Rapperswil
   6  *
   7  * This program is free software; you can redistribute it and/or modify it
   8  * under the terms of the GNU General Public License as published by the
   9  * Free Software Foundation; either version 2 of the License, or (at your
  10  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  14  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15  * for more details.
  16  */
  17
  18 #include "child_create.h"
  19
  20 #include <daemon.h>
  21 #include <hydra.h>
  22 #include <sa/ikev2/keymat_v2.h>
  23 #include <crypto/diffie_hellman.h>
  24 #include <credentials/certificates/x509.h>
  25 #include <encoding/payloads/sa_payload.h>
  26 #include <encoding/payloads/ke_payload.h>
  27 #include <encoding/payloads/ts_payload.h>
  28 #include <encoding/payloads/nonce_payload.h>
  29 #include <encoding/payloads/notify_payload.h>
  30 #include <encoding/payloads/delete_payload.h>
  31 #include <processing/jobs/delete_ike_sa_job.h>
  32 #include <processing/jobs/inactivity_job.h>
  33
  34
  35 typedef struct private_child_create_t private_child_create_t;
  36
  37 /**
  38  * Private members of a child_create_t task.
  39  */
  40 struct private_child_create_t {
  41
  42         /**
  43          * Public methods and task_t interface.
  44          */
  45         child_create_t public;
  46
  47         /**
  48          * Assigned IKE_SA.
  49          */
  50         ike_sa_t *ike_sa;
  51
  52         /**
  53          * Are we the initiator?
  54          */
  55         bool initiator;
  56
  57         /**
  58          * nonce chosen by us
  59          */
  60         chunk_t my_nonce;
  61
  62         /**
  63          * nonce chosen by peer
  64          */
  65         chunk_t other_nonce;
  66
  67         /**
  68          * config to create the CHILD_SA from
  69          */
  70         child_cfg_t *config;
  71
  72         /**
  73          * list of proposal candidates
  74          */
  75         linked_list_t *proposals;
  76
  77         /**
  78          * selected proposal to use for CHILD_SA
  79          */
  80         proposal_t *proposal;
  81
  82         /**
  83          * traffic selectors for initiators side
  84          */
  85         linked_list_t *tsi;
  86
  87         /**
  88          * traffic selectors for responders side
  89          */
  90         linked_list_t *tsr;
  91
  92         /**
  93          * source of triggering packet
  94          */
  95         traffic_selector_t *packet_tsi;
  96
  97         /**
  98          * destination of triggering packet
  99          */
 100         traffic_selector_t *packet_tsr;
 101
 102         /**
 103          * optional diffie hellman exchange
 104          */
 105         diffie_hellman_t *dh;
 106
 107         /**
 108          * group used for DH exchange
 109          */
 110         diffie_hellman_group_t dh_group;
 111
 112         /**
 113          * IKE_SAs keymat
 114          */
 115         keymat_v2_t *keymat;
 116
 117         /**
 118          * mode the new CHILD_SA uses (transport/tunnel/beet)
 119          */
 120         ipsec_mode_t mode;
 121
 122         /**
 123          * peer accepts TFC padding for this SA
 124          */
 125         bool tfcv3;
 126
 127         /**
 128          * IPComp transform to use
 129          */
 130         ipcomp_transform_t ipcomp;
 131
 132         /**
 133          * IPComp transform proposed or accepted by the other peer
 134          */
 135         ipcomp_transform_t ipcomp_received;
 136
 137         /**
 138          * Own allocated SPI
 139          */
 140         u_int32_t my_spi;
 141
 142         /**
 143          * SPI received in proposal
 144          */
 145         u_int32_t other_spi;
 146
 147         /**
 148          * Own allocated Compression Parameter Index (CPI)
 149          */
 150         u_int16_t my_cpi;
 151
 152         /**
 153          * Other Compression Parameter Index (CPI), received via IPCOMP_SUPPORTED
 154          */
 155         u_int16_t other_cpi;
 156
 157         /**
 158          * reqid to use if we are rekeying
 159          */
 160         u_int32_t reqid;
 161
 162         /**
 163          * Explicit inbound mark value
 164          */
 165         u_int mark_in;
 166
 167         /**
 168          * Explicit outbound mark value
 169          */
 170         u_int mark_out;
 171
 172         /**
 173          * CHILD_SA which gets established
 174          */
 175         child_sa_t *child_sa;
 176
 177         /**
 178          * successfully established the CHILD?
 179          */
 180         bool established;
 181
 182         /**
 183          * whether the CHILD_SA rekeys an existing one
 184          */
 185         bool rekey;
 186
 187         /**
 188          * whether we are retrying with another DH group
 189          */
 190         bool retry;
 191 };
 192
 193 /**
 194  * get the nonce from a message
 195  */
 196 static status_t get_nonce(message_t *message, chunk_t *nonce)
 197 {
 198         nonce_payload_t *payload;
 199
 200         payload = (nonce_payload_t*)message->get_payload(message, PLV2_NONCE);
 201         if (payload == NULL)
 202         {
 203                 return FAILED;
 204         }
 205         *nonce = payload->get_nonce(payload);
 206         return NEED_MORE;
 207 }
 208
 209 /**
 210  * generate a new nonce to include in a CREATE_CHILD_SA message
 211  */
 212 static status_t generate_nonce(private_child_create_t *this)
 213 {
 214         nonce_gen_t *nonceg;
 215
 216         nonceg = this->keymat->keymat.create_nonce_gen(&this->keymat->keymat);
 217         if (!nonceg)
 218         {
 219                 DBG1(DBG_IKE, "no nonce generator found to create nonce");
 220                 return FAILED;
 221         }
 222         if (!nonceg->allocate_nonce(nonceg, NONCE_SIZE, &this->my_nonce))
 223         {
 224                 DBG1(DBG_IKE, "nonce allocation failed");
 225                 nonceg->destroy(nonceg);
 226                 return FAILED;
 227         }
 228         nonceg->destroy(nonceg);
 229
 230         return SUCCESS;
 231 }
 232
 233 /**
 234  * Check a list of traffic selectors if any selector belongs to host
 235  */
 236 static bool ts_list_is_host(linked_list_t *list, host_t *host)
 237 {
 238         traffic_selector_t *ts;
 239         bool is_host = TRUE;
 240         enumerator_t *enumerator = list->create_enumerator(list);
 241
 242         while (is_host && enumerator->enumerate(enumerator, (void**)&ts))
 243         {
 244                 is_host = is_host && ts->is_host(ts, host);
 245         }
 246         enumerator->destroy(enumerator);
 247         return is_host;
 248 }
 249
 250 /**
 251  * Allocate SPIs and update proposals
 252  */
 253 static bool allocate_spi(private_child_create_t *this)
 254 {
 255         enumerator_t *enumerator;
 256         proposal_t *proposal;
 257         protocol_id_t proto = PROTO_ESP;
 258
 259         if (this->initiator)
 260         {
 261                 /* we just get a SPI for the first protocol. TODO: If we ever support
 262                  * proposal lists with mixed protocols, we'd need multiple SPIs */
 263                 if (this->proposals->get_first(this->proposals,
 264                                                                            (void**)&proposal) == SUCCESS)
 265                 {
 266                         proto = proposal->get_protocol(proposal);
 267                 }
 268         }
 269         else
 270         {
 271                 proto = this->proposal->get_protocol(this->proposal);
 272         }
 273         this->my_spi = this->child_sa->alloc_spi(this->child_sa, proto);
 274         if (this->my_spi)
 275         {
 276                 if (this->initiator)
 277                 {
 278                         enumerator = this->proposals->create_enumerator(this->proposals);
 279                         while (enumerator->enumerate(enumerator, &proposal))
 280                         {
 281                                 proposal->set_spi(proposal, this->my_spi);
 282                         }
 283                         enumerator->destroy(enumerator);
 284                 }
 285                 else
 286                 {
 287                         this->proposal->set_spi(this->proposal, this->my_spi);
 288                 }
 289                 return TRUE;
 290         }
 291         return FALSE;
 292 }
 293
 294 /**
 295  * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
 296  */
 297 static void schedule_inactivity_timeout(private_child_create_t *this)
 298 {
 299         u_int32_t timeout, id;
 300         bool close_ike;
 301
 302         timeout = this->config->get_inactivity(this->config);
 303         if (timeout)
 304         {
 305                 close_ike = lib->settings->get_bool(lib->settings,
 306                                                                         "%s.inactivity_close_ike", FALSE, lib->ns);
 307                 id = this->child_sa->get_unique_id(this->child_sa);
 308                 lib->scheduler->schedule_job(lib->scheduler, (job_t*)
 309                                                 inactivity_job_create(id, timeout, close_ike), timeout);
 310         }
 311 }
 312
 313 /**
 314  * Check if we have a an address pool configured
 315  */
 316 static bool have_pool(ike_sa_t *ike_sa)
 317 {
 318         enumerator_t *enumerator;
 319         peer_cfg_t *peer_cfg;
 320         char *pool;
 321         bool found = FALSE;
 322
 323         peer_cfg = ike_sa->get_peer_cfg(ike_sa);
 324         if (peer_cfg)
 325         {
 326                 enumerator = peer_cfg->create_pool_enumerator(peer_cfg);
 327                 if (enumerator->enumerate(enumerator, &pool))
 328                 {
 329                         found = TRUE;
 330                 }
 331                 enumerator->destroy(enumerator);
 332         }
 333         return found;
 334 }
 335
 336 /**
 337  * Get hosts to use for dynamic traffic selectors
 338  */
 339 static linked_list_t *get_dynamic_hosts(ike_sa_t *ike_sa, bool local)
 340 {
 341         enumerator_t *enumerator;
 342         linked_list_t *list;
 343         host_t *host;
 344
 345         list = linked_list_create();
 346         enumerator = ike_sa->create_virtual_ip_enumerator(ike_sa, local);
 347         while (enumerator->enumerate(enumerator, &host))
 348         {
 349                 list->insert_last(list, host);
 350         }
 351         enumerator->destroy(enumerator);
 352
 353         if (list->get_count(list) == 0)
 354         {       /* no virtual IPs assigned */
 355                 if (local)
 356                 {
 357                         host = ike_sa->get_my_host(ike_sa);
 358                         list->insert_last(list, host);
 359                 }
 360                 else if (!have_pool(ike_sa))
 361                 {       /* use host only if we don't have a pool configured */
 362                         host = ike_sa->get_other_host(ike_sa);
 363                         list->insert_last(list, host);
 364                 }
 365         }
 366         return list;
 367 }
 368
 369 /**
 370  * Substitude any host address with NATed address in traffic selector
 371  */
 372 static linked_list_t* get_transport_nat_ts(private_child_create_t *this,
 373                                                                                    bool local, linked_list_t *in)
 374 {
 375         enumerator_t *enumerator;
 376         linked_list_t *out;
 377         traffic_selector_t *ts;
 378         host_t *ike, *first = NULL;
 379         u_int8_t mask;
 380
 381         if (local)
 382         {
 383                 ike = this->ike_sa->get_my_host(this->ike_sa);
 384         }
 385         else
 386         {
 387                 ike = this->ike_sa->get_other_host(this->ike_sa);
 388         }
 389
 390         out = linked_list_create();
 391
 392         enumerator = in->create_enumerator(in);
 393         while (enumerator->enumerate(enumerator, &ts))
 394         {
 395                 /* require that all selectors match the first "host" selector */
 396                 if (ts->is_host(ts, first))
 397                 {
 398                         if (!first)
 399                         {
 400                                 ts->to_subnet(ts, &first, &mask);
 401                         }
 402                         ts = ts->clone(ts);
 403                         ts->set_address(ts, ike);
 404                         out->insert_last(out, ts);
 405                 }
 406         }
 407         enumerator->destroy(enumerator);
 408         DESTROY_IF(first);
 409
 410         return out;
 411 }
 412
 413 /**
 414  * Narrow received traffic selectors with configuration
 415  */
 416 static linked_list_t* narrow_ts(private_child_create_t *this, bool local,
 417                                                                 linked_list_t *in)
 418 {
 419         linked_list_t *hosts, *nat, *ts;
 420         ike_condition_t cond;
 421
 422         cond = local ? COND_NAT_HERE : COND_NAT_THERE;
 423         hosts = get_dynamic_hosts(this->ike_sa, local);
 424
 425         if (this->mode == MODE_TRANSPORT &&
 426                 this->ike_sa->has_condition(this->ike_sa, cond))
 427         {
 428                 nat = get_transport_nat_ts(this, local, in);
 429                 ts = this->config->get_traffic_selectors(this->config, local, nat, hosts);
 430                 nat->destroy_offset(nat, offsetof(traffic_selector_t, destroy));
 431         }
 432         else
 433         {
 434                 ts = this->config->get_traffic_selectors(this->config, local, in, hosts);
 435         }
 436
 437         hosts->destroy(hosts);
 438
 439         return ts;
 440 }
 441
 442 /**
 443  * Install a CHILD_SA for usage, return value:
 444  * - FAILED: no acceptable proposal
 445  * - INVALID_ARG: diffie hellman group inacceptable
 446  * - NOT_FOUND: TS inacceptable
 447  */
 448 static status_t select_and_install(private_child_create_t *this,
 449                                                                    bool no_dh, bool ike_auth)
 450 {
 451         status_t status, status_i, status_o;
 452         chunk_t nonce_i, nonce_r;
 453         chunk_t encr_i = chunk_empty, encr_r = chunk_empty;
 454         chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
 455         linked_list_t *my_ts, *other_ts;
 456         host_t *me, *other;
 457         bool private;
 458
 459         if (this->proposals == NULL)
 460         {
 461                 DBG1(DBG_IKE, "SA payload missing in message");
 462                 return FAILED;
 463         }
 464         if (this->tsi == NULL || this->tsr == NULL)
 465         {
 466                 DBG1(DBG_IKE, "TS payloads missing in message");
 467                 return NOT_FOUND;
 468         }
 469
 470         me = this->ike_sa->get_my_host(this->ike_sa);
 471         other = this->ike_sa->get_other_host(this->ike_sa);
 472
 473         private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
 474         this->proposal = this->config->select_proposal(this->config,
 475                                                                                         this->proposals, no_dh, private);
 476         if (this->proposal == NULL)
 477         {
 478                 DBG1(DBG_IKE, "no acceptable proposal found");
 479                 charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_CHILD,
 480                                                    this->proposals);
 481                 return FAILED;
 482         }
 483         this->other_spi = this->proposal->get_spi(this->proposal);
 484
 485         if (!this->initiator && !allocate_spi(this))
 486         {       /* responder has no SPI allocated yet */
 487                 DBG1(DBG_IKE, "allocating SPI failed");
 488                 return FAILED;
 489         }
 490         this->child_sa->set_proposal(this->child_sa, this->proposal);
 491
 492         if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
 493         {
 494                 u_int16_t group;
 495
 496                 if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
 497                                                                                   &group, NULL))
 498                 {
 499                         DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
 500                                  diffie_hellman_group_names, this->dh_group,
 501                                  diffie_hellman_group_names, group);
 502                         this->dh_group = group;
 503                         return INVALID_ARG;
 504                 }
 505                 /* the selected proposal does not use a DH group */
 506                 DBG1(DBG_IKE, "ignoring KE exchange, agreed on a non-PFS proposal");
 507                 DESTROY_IF(this->dh);
 508                 this->dh = NULL;
 509                 this->dh_group = MODP_NONE;
 510         }
 511
 512         if (this->initiator)
 513         {
 514                 nonce_i = this->my_nonce;
 515                 nonce_r = this->other_nonce;
 516                 my_ts = narrow_ts(this, TRUE, this->tsi);
 517                 other_ts = narrow_ts(this, FALSE, this->tsr);
 518         }
 519         else
 520         {
 521                 nonce_r = this->my_nonce;
 522                 nonce_i = this->other_nonce;
 523                 my_ts = narrow_ts(this, TRUE, this->tsr);
 524                 other_ts = narrow_ts(this, FALSE, this->tsi);
 525         }
 526
 527         if (this->initiator)
 528         {
 529                 if (ike_auth)
 530                 {
 531                         charon->bus->narrow(charon->bus, this->child_sa,
 532                                                                 NARROW_INITIATOR_POST_NOAUTH, my_ts, other_ts);
 533                 }
 534                 else
 535                 {
 536                         charon->bus->narrow(charon->bus, this->child_sa,
 537                                                                 NARROW_INITIATOR_POST_AUTH, my_ts, other_ts);
 538                 }
 539         }
 540         else
 541         {
 542                 charon->bus->narrow(charon->bus, this->child_sa,
 543                                                         NARROW_RESPONDER, my_ts, other_ts);
 544         }
 545
 546         if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
 547         {
 548                 charon->bus->alert(charon->bus, ALERT_TS_MISMATCH, this->tsi, this->tsr);
 549                 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
 550                 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
 551                 DBG1(DBG_IKE, "no acceptable traffic selectors found");
 552                 return NOT_FOUND;
 553         }
 554
 555         this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
 556         this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
 557         if (this->initiator)
 558         {
 559                 this->tsi = my_ts;
 560                 this->tsr = other_ts;
 561         }
 562         else
 563         {
 564                 this->tsr = my_ts;
 565                 this->tsi = other_ts;
 566         }
 567
 568         if (!this->initiator)
 569         {
 570                 /* check if requested mode is acceptable, downgrade if required */
 571                 switch (this->mode)
 572                 {
 573                         case MODE_TRANSPORT:
 574                                 if (!this->config->use_proxy_mode(this->config) &&
 575                                            (!ts_list_is_host(this->tsi, other) ||
 576                                                 !ts_list_is_host(this->tsr, me))
 577                                    )
 578                                 {
 579                                         this->mode = MODE_TUNNEL;
 580                                         DBG1(DBG_IKE, "not using transport mode, not host-to-host");
 581                                 }
 582                                 if (this->config->get_mode(this->config) != MODE_TRANSPORT)
 583                                 {
 584                                         this->mode = MODE_TUNNEL;
 585                                 }
 586                                 break;
 587                         case MODE_BEET:
 588                                 if (!ts_list_is_host(this->tsi, NULL) ||
 589                                         !ts_list_is_host(this->tsr, NULL))
 590                                 {
 591                                         this->mode = MODE_TUNNEL;
 592                                         DBG1(DBG_IKE, "not using BEET mode, not host-to-host");
 593                                 }
 594                                 if (this->config->get_mode(this->config) != MODE_BEET)
 595                                 {
 596                                         this->mode = MODE_TUNNEL;
 597                                 }
 598                                 break;
 599                         default:
 600                                 break;
 601                 }
 602         }
 603
 604         this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 605         this->child_sa->set_ipcomp(this->child_sa, this->ipcomp);
 606         this->child_sa->set_mode(this->child_sa, this->mode);
 607         this->child_sa->set_protocol(this->child_sa,
 608                                                                  this->proposal->get_protocol(this->proposal));
 609
 610         if (this->my_cpi == 0 || this->other_cpi == 0 || this->ipcomp == IPCOMP_NONE)
 611         {
 612                 this->my_cpi = this->other_cpi = 0;
 613                 this->ipcomp = IPCOMP_NONE;
 614         }
 615         status_i = status_o = FAILED;
 616         if (this->keymat->derive_child_keys(this->keymat, this->proposal,
 617                         this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
 618         {
 619                 if (this->initiator)
 620                 {
 621                         status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
 622                                                         this->my_spi, this->my_cpi, this->initiator,
 623                                                         TRUE, this->tfcv3, my_ts, other_ts);
 624                         status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
 625                                                         this->other_spi, this->other_cpi, this->initiator,
 626                                                         FALSE, this->tfcv3, my_ts, other_ts);
 627                 }
 628                 else
 629                 {
 630                         status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
 631                                                         this->my_spi, this->my_cpi, this->initiator,
 632                                                         TRUE, this->tfcv3, my_ts, other_ts);
 633                         status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
 634                                                         this->other_spi, this->other_cpi, this->initiator,
 635                                                         FALSE, this->tfcv3, my_ts, other_ts);
 636                 }
 637         }
 638         chunk_clear(&integ_i);
 639         chunk_clear(&integ_r);
 640         chunk_clear(&encr_i);
 641         chunk_clear(&encr_r);
 642
 643         if (status_i != SUCCESS || status_o != SUCCESS)
 644         {
 645                 DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
 646                         (status_i != SUCCESS) ? "inbound " : "",
 647                         (status_i != SUCCESS && status_o != SUCCESS) ? "and ": "",
 648                         (status_o != SUCCESS) ? "outbound " : "");
 649                 charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_SA_FAILED,
 650                                                    this->child_sa);
 651                 return FAILED;
 652         }
 653
 654         if (this->initiator)
 655         {
 656                 status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
 657         }
 658         else
 659         {
 660                 /* use a copy of the traffic selectors, as the POST hook should not
 661                  * change payloads */
 662                 my_ts = this->tsr->clone_offset(this->tsr,
 663                                                                                 offsetof(traffic_selector_t, clone));
 664                 other_ts = this->tsi->clone_offset(this->tsi,
 665                                                                                 offsetof(traffic_selector_t, clone));
 666                 charon->bus->narrow(charon->bus, this->child_sa,
 667                                                         NARROW_RESPONDER_POST, my_ts, other_ts);
 668                 if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
 669                 {
 670                         status = FAILED;
 671                 }
 672                 else
 673                 {
 674                         status = this->child_sa->add_policies(this->child_sa,
 675                                                                                                    my_ts, other_ts);
 676                 }
 677                 my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
 678                 other_ts->destroy_offset(other_ts, offsetof(traffic_selector_t, destroy));
 679         }
 680         if (status != SUCCESS)
 681         {
 682                 DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 683                 charon->bus->alert(charon->bus, ALERT_INSTALL_CHILD_POLICY_FAILED,
 684                                                    this->child_sa);
 685                 return NOT_FOUND;
 686         }
 687
 688         charon->bus->child_keys(charon->bus, this->child_sa, this->initiator,
 689                                                         this->dh, nonce_i, nonce_r);
 690
 691         /* add to IKE_SA, and remove from task */
 692         this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 693         this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 694         this->established = TRUE;
 695
 696         schedule_inactivity_timeout(this);
 697
 698         my_ts = linked_list_create_from_enumerator(
 699                                 this->child_sa->create_ts_enumerator(this->child_sa, TRUE));
 700         other_ts = linked_list_create_from_enumerator(
 701                                 this->child_sa->create_ts_enumerator(this->child_sa, FALSE));
 702
 703         DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
 704                  "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
 705                  this->child_sa->get_name(this->child_sa),
 706                  this->child_sa->get_unique_id(this->child_sa),
 707                  ntohl(this->child_sa->get_spi(this->child_sa, TRUE)),
 708                  ntohl(this->child_sa->get_spi(this->child_sa, FALSE)), my_ts, other_ts);
 709
 710         my_ts->destroy(my_ts);
 711         other_ts->destroy(other_ts);
 712
 713         return SUCCESS;
 714 }
 715
 716 /**
 717  * build the payloads for the message
 718  */
 719 static void build_payloads(private_child_create_t *this, message_t *message)
 720 {
 721         sa_payload_t *sa_payload;
 722         nonce_payload_t *nonce_payload;
 723         ke_payload_t *ke_payload;
 724         ts_payload_t *ts_payload;
 725         kernel_feature_t features;
 726
 727         /* add SA payload */
 728         if (this->initiator)
 729         {
 730                 sa_payload = sa_payload_create_from_proposals_v2(this->proposals);
 731         }
 732         else
 733         {
 734                 sa_payload = sa_payload_create_from_proposal_v2(this->proposal);
 735         }
 736         message->add_payload(message, (payload_t*)sa_payload);
 737
 738         /* add nonce payload if not in IKE_AUTH */
 739         if (message->get_exchange_type(message) == CREATE_CHILD_SA)
 740         {
 741                 nonce_payload = nonce_payload_create(PLV2_NONCE);
 742                 nonce_payload->set_nonce(nonce_payload, this->my_nonce);
 743                 message->add_payload(message, (payload_t*)nonce_payload);
 744         }
 745
 746         /* diffie hellman exchange, if PFS enabled */
 747         if (this->dh)
 748         {
 749                 ke_payload = ke_payload_create_from_diffie_hellman(PLV2_KEY_EXCHANGE,
 750                                                                                                                    this->dh);
 751                 message->add_payload(message, (payload_t*)ke_payload);
 752         }
 753
 754         /* add TSi/TSr payloads */
 755         ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
 756         message->add_payload(message, (payload_t*)ts_payload);
 757         ts_payload = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
 758         message->add_payload(message, (payload_t*)ts_payload);
 759
 760         /* add a notify if we are not in tunnel mode */
 761         switch (this->mode)
 762         {
 763                 case MODE_TRANSPORT:
 764                         message->add_notify(message, FALSE, USE_TRANSPORT_MODE, chunk_empty);
 765                         break;
 766                 case MODE_BEET:
 767                         message->add_notify(message, FALSE, USE_BEET_MODE, chunk_empty);
 768                         break;
 769                 default:
 770                         break;
 771         }
 772
 773         features = hydra->kernel_interface->get_features(hydra->kernel_interface);
 774         if (!(features & KERNEL_ESP_V3_TFC))
 775         {
 776                 message->add_notify(message, FALSE, ESP_TFC_PADDING_NOT_SUPPORTED,
 777                                                         chunk_empty);
 778         }
 779 }
 780
 781 /**
 782  * Adds an IPCOMP_SUPPORTED notify to the message, allocating a CPI
 783  */
 784 static void add_ipcomp_notify(private_child_create_t *this,
 785                                                                   message_t *message, u_int8_t ipcomp)
 786 {
 787         this->my_cpi = this->child_sa->alloc_cpi(this->child_sa);
 788         if (this->my_cpi)
 789         {
 790                 this->ipcomp = ipcomp;
 791                 message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
 792                                                         chunk_cata("cc", chunk_from_thing(this->my_cpi),
 793                                                                            chunk_from_thing(ipcomp)));
 794         }
 795         else
 796         {
 797                 DBG1(DBG_IKE, "unable to allocate a CPI from kernel, IPComp disabled");
 798         }
 799 }
 800
 801 /**
 802  * handle a received notify payload
 803  */
 804 static void handle_notify(private_child_create_t *this, notify_payload_t *notify)
 805 {
 806         switch (notify->get_notify_type(notify))
 807         {
 808                 case USE_TRANSPORT_MODE:
 809                         this->mode = MODE_TRANSPORT;
 810                         break;
 811                 case USE_BEET_MODE:
 812                         if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
 813                         {       /* handle private use notify only if we know its meaning */
 814                                 this->mode = MODE_BEET;
 815                         }
 816                         else
 817                         {
 818                                 DBG1(DBG_IKE, "received a notify strongSwan uses for BEET "
 819                                          "mode, but peer implementation unknown, skipped");
 820                         }
 821                         break;
 822                 case IPCOMP_SUPPORTED:
 823                 {
 824                         ipcomp_transform_t ipcomp;
 825                         u_int16_t cpi;
 826                         chunk_t data;
 827
 828                         data = notify->get_notification_data(notify);
 829                         cpi = *(u_int16_t*)data.ptr;
 830                         ipcomp = (ipcomp_transform_t)(*(data.ptr + 2));
 831                         switch (ipcomp)
 832                         {
 833                                 case IPCOMP_DEFLATE:
 834                                         this->other_cpi = cpi;
 835                                         this->ipcomp_received = ipcomp;
 836                                         break;
 837                                 case IPCOMP_LZS:
 838                                 case IPCOMP_LZJH:
 839                                 default:
 840                                         DBG1(DBG_IKE, "received IPCOMP_SUPPORTED notify with a "
 841                                                  "transform ID we don't support %N",
 842                                                  ipcomp_transform_names, ipcomp);
 843                                         break;
 844                         }
 845                         break;
 846                 }
 847                 case ESP_TFC_PADDING_NOT_SUPPORTED:
 848                         DBG1(DBG_IKE, "received %N, not using ESPv3 TFC padding",
 849                                  notify_type_names, notify->get_notify_type(notify));
 850                         this->tfcv3 = FALSE;
 851                         break;
 852                 default:
 853                         break;
 854         }
 855 }
 856
 857 /**
 858  * Read payloads from message
 859  */
 860 static void process_payloads(private_child_create_t *this, message_t *message)
 861 {
 862         enumerator_t *enumerator;
 863         payload_t *payload;
 864         sa_payload_t *sa_payload;
 865         ke_payload_t *ke_payload;
 866         ts_payload_t *ts_payload;
 867
 868         /* defaults to TUNNEL mode */
 869         this->mode = MODE_TUNNEL;
 870
 871         enumerator = message->create_payload_enumerator(message);
 872         while (enumerator->enumerate(enumerator, &payload))
 873         {
 874                 switch (payload->get_type(payload))
 875                 {
 876                         case PLV2_SECURITY_ASSOCIATION:
 877                                 sa_payload = (sa_payload_t*)payload;
 878                                 this->proposals = sa_payload->get_proposals(sa_payload);
 879                                 break;
 880                         case PLV2_KEY_EXCHANGE:
 881                                 ke_payload = (ke_payload_t*)payload;
 882                                 if (!this->initiator)
 883                                 {
 884                                         this->dh_group = ke_payload->get_dh_group_number(ke_payload);
 885                                         this->dh = this->keymat->keymat.create_dh(
 886                                                                                 &this->keymat->keymat, this->dh_group);
 887                                 }
 888                                 if (this->dh)
 889                                 {
 890                                         this->dh->set_other_public_value(this->dh,
 891                                                                 ke_payload->get_key_exchange_data(ke_payload));
 892                                 }
 893                                 break;
 894                         case PLV2_TS_INITIATOR:
 895                                 ts_payload = (ts_payload_t*)payload;
 896                                 this->tsi = ts_payload->get_traffic_selectors(ts_payload);
 897                                 break;
 898                         case PLV2_TS_RESPONDER:
 899                                 ts_payload = (ts_payload_t*)payload;
 900                                 this->tsr = ts_payload->get_traffic_selectors(ts_payload);
 901                                 break;
 902                         case PLV2_NOTIFY:
 903                                 handle_notify(this, (notify_payload_t*)payload);
 904                                 break;
 905                         default:
 906                                 break;
 907                 }
 908         }
 909         enumerator->destroy(enumerator);
 910 }
 911
 912 METHOD(task_t, build_i, status_t,
 913         private_child_create_t *this, message_t *message)
 914 {
 915         enumerator_t *enumerator;
 916         host_t *vip;
 917         peer_cfg_t *peer_cfg;
 918         linked_list_t *list;
 919
 920         switch (message->get_exchange_type(message))
 921         {
 922                 case IKE_SA_INIT:
 923                         return get_nonce(message, &this->my_nonce);
 924                 case CREATE_CHILD_SA:
 925                         if (generate_nonce(this) != SUCCESS)
 926                         {
 927                                 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
 928                                 return SUCCESS;
 929                         }
 930                         if (!this->retry)
 931                         {
 932                                 this->dh_group = this->config->get_dh_group(this->config);
 933                         }
 934                         break;
 935                 case IKE_AUTH:
 936                         if (message->get_message_id(message) != 1)
 937                         {
 938                                 /* send only in the first request, not in subsequent rounds */
 939                                 return NEED_MORE;
 940                         }
 941                         break;
 942                 default:
 943                         break;
 944         }
 945
 946         if (this->reqid)
 947         {
 948                 DBG0(DBG_IKE, "establishing CHILD_SA %s{%d}",
 949                          this->config->get_name(this->config), this->reqid);
 950         }
 951         else
 952         {
 953                 DBG0(DBG_IKE, "establishing CHILD_SA %s",
 954                          this->config->get_name(this->config));
 955         }
 956
 957         /* check if we want a virtual IP, but don't have one */
 958         list = linked_list_create();
 959         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 960         if (!this->rekey)
 961         {
 962                 enumerator = peer_cfg->create_virtual_ip_enumerator(peer_cfg);
 963                 while (enumerator->enumerate(enumerator, &vip))
 964                 {
 965                         /* propose a 0.0.0.0/0 or ::/0 subnet when we use virtual ip */
 966                         vip = host_create_any(vip->get_family(vip));
 967                         list->insert_last(list, vip);
 968                 }
 969                 enumerator->destroy(enumerator);
 970         }
 971         if (list->get_count(list))
 972         {
 973                 this->tsi = this->config->get_traffic_selectors(this->config,
 974                                                                                                                 TRUE, NULL, list);
 975                 list->destroy_offset(list, offsetof(host_t, destroy));
 976         }
 977         else
 978         {       /* no virtual IPs configured */
 979                 list->destroy(list);
 980                 list = get_dynamic_hosts(this->ike_sa, TRUE);
 981                 this->tsi = this->config->get_traffic_selectors(this->config,
 982                                                                                                                 TRUE, NULL, list);
 983                 list->destroy(list);
 984         }
 985         list = get_dynamic_hosts(this->ike_sa, FALSE);
 986         this->tsr = this->config->get_traffic_selectors(this->config,
 987                                                                                                         FALSE, NULL, list);
 988         list->destroy(list);
 989
 990         if (this->packet_tsi)
 991         {
 992                 this->tsi->insert_first(this->tsi,
 993                                                                 this->packet_tsi->clone(this->packet_tsi));
 994         }
 995         if (this->packet_tsr)
 996         {
 997                 this->tsr->insert_first(this->tsr,
 998                                                                 this->packet_tsr->clone(this->packet_tsr));
 999         }
1000         this->proposals = this->config->get_proposals(this->config,
1001                                                                                                   this->dh_group == MODP_NONE);
1002         this->mode = this->config->get_mode(this->config);
1003
1004         this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
1005                         this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
1006                         this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY),
1007                         this->mark_in, this->mark_out);
1008
1009         if (!allocate_spi(this))
1010         {
1011                 DBG1(DBG_IKE, "unable to allocate SPIs from kernel");
1012                 return FAILED;
1013         }
1014
1015         if (this->dh_group != MODP_NONE)
1016         {
1017                 this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
1018                                                                                                   this->dh_group);
1019         }
1020
1021         if (this->config->use_ipcomp(this->config))
1022         {
1023                 /* IPCOMP_DEFLATE is the only transform we support at the moment */
1024                 add_ipcomp_notify(this, message, IPCOMP_DEFLATE);
1025         }
1026
1027         if (message->get_exchange_type(message) == IKE_AUTH)
1028         {
1029                 charon->bus->narrow(charon->bus, this->child_sa,
1030                                                         NARROW_INITIATOR_PRE_NOAUTH, this->tsi, this->tsr);
1031         }
1032         else
1033         {
1034                 charon->bus->narrow(charon->bus, this->child_sa,
1035                                                         NARROW_INITIATOR_PRE_AUTH, this->tsi, this->tsr);
1036         }
1037
1038         build_payloads(this, message);
1039
1040         this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1041         this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1042         this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1043         this->tsi = NULL;
1044         this->tsr = NULL;
1045         this->proposals = NULL;
1046
1047         return NEED_MORE;
1048 }
1049
1050 METHOD(task_t, process_r, status_t,
1051         private_child_create_t *this, message_t *message)
1052 {
1053         switch (message->get_exchange_type(message))
1054         {
1055                 case IKE_SA_INIT:
1056                         return get_nonce(message, &this->other_nonce);
1057                 case CREATE_CHILD_SA:
1058                         get_nonce(message, &this->other_nonce);
1059                         break;
1060                 case IKE_AUTH:
1061                         if (message->get_message_id(message) != 1)
1062                         {
1063                                 /* only handle first AUTH payload, not additional rounds */
1064                                 return NEED_MORE;
1065                         }
1066                 default:
1067                         break;
1068         }
1069
1070         process_payloads(this, message);
1071
1072         return NEED_MORE;
1073 }
1074
1075 /**
1076  * handle CHILD_SA setup failure
1077  */
1078 static void handle_child_sa_failure(private_child_create_t *this,
1079                                                                         message_t *message)
1080 {
1081         if (message->get_exchange_type(message) == IKE_AUTH &&
1082                 lib->settings->get_bool(lib->settings,
1083                                                                 "%s.close_ike_on_child_failure", FALSE, lib->ns))
1084         {
1085                 /* we delay the delete for 100ms, as the IKE_AUTH response must arrive
1086                  * first */
1087                 DBG1(DBG_IKE, "closing IKE_SA due CHILD_SA setup failure");
1088                 lib->scheduler->schedule_job_ms(lib->scheduler, (job_t*)
1089                         delete_ike_sa_job_create(this->ike_sa->get_id(this->ike_sa), TRUE),
1090                         100);
1091         }
1092         else
1093         {
1094                 DBG1(DBG_IKE, "failed to establish CHILD_SA, keeping IKE_SA");
1095                 charon->bus->alert(charon->bus, ALERT_KEEP_ON_CHILD_SA_FAILURE);
1096         }
1097 }
1098
1099 /**
1100  * Substitute transport mode NAT selectors, if applicable
1101  */
1102 static linked_list_t* get_ts_if_nat_transport(private_child_create_t *this,
1103                                                                                           bool local, linked_list_t *in)
1104 {
1105         linked_list_t *out = NULL;
1106         ike_condition_t cond;
1107
1108         if (this->mode == MODE_TRANSPORT)
1109         {
1110                 cond = local ? COND_NAT_HERE : COND_NAT_THERE;
1111                 if (this->ike_sa->has_condition(this->ike_sa, cond))
1112                 {
1113                         out = get_transport_nat_ts(this, local, in);
1114                         if (out->get_count(out) == 0)
1115                         {
1116                                 out->destroy(out);
1117                                 out = NULL;
1118                         }
1119                 }
1120         }
1121         return out;
1122 }
1123
1124 /**
1125  * Select a matching CHILD config as responder
1126  */
1127 static child_cfg_t* select_child_cfg(private_child_create_t *this)
1128 {
1129         peer_cfg_t *peer_cfg;
1130         child_cfg_t *child_cfg = NULL;;
1131
1132         peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
1133         if (peer_cfg && this->tsi && this->tsr)
1134         {
1135                 linked_list_t *listr, *listi, *tsr, *tsi;
1136
1137                 tsr = get_ts_if_nat_transport(this, TRUE, this->tsr);
1138                 tsi = get_ts_if_nat_transport(this, FALSE, this->tsi);
1139
1140                 listr = get_dynamic_hosts(this->ike_sa, TRUE);
1141                 listi = get_dynamic_hosts(this->ike_sa, FALSE);
1142                 child_cfg = peer_cfg->select_child_cfg(peer_cfg,
1143                                                                                         tsr ?: this->tsr, tsi ?: this->tsi,
1144                                                                                         listr, listi);
1145                 if ((tsi || tsr) && child_cfg &&
1146                         child_cfg->get_mode(child_cfg) != MODE_TRANSPORT)
1147                 {
1148                         /* found a CHILD config, but it doesn't use transport mode */
1149                         child_cfg->destroy(child_cfg);
1150                         child_cfg = NULL;
1151                 }
1152                 if (!child_cfg && (tsi || tsr))
1153                 {
1154                         /* no match for the substituted NAT selectors, try it without */
1155                         child_cfg = peer_cfg->select_child_cfg(peer_cfg,
1156                                                                                         this->tsr, this->tsi, listr, listi);
1157                 }
1158                 listr->destroy(listr);
1159                 listi->destroy(listi);
1160                 DESTROY_OFFSET_IF(tsi, offsetof(traffic_selector_t, destroy));
1161                 DESTROY_OFFSET_IF(tsr, offsetof(traffic_selector_t, destroy));
1162         }
1163
1164         return child_cfg;
1165 }
1166
1167 METHOD(task_t, build_r, status_t,
1168         private_child_create_t *this, message_t *message)
1169 {
1170         payload_t *payload;
1171         enumerator_t *enumerator;
1172         bool no_dh = TRUE, ike_auth = FALSE;
1173
1174         switch (message->get_exchange_type(message))
1175         {
1176                 case IKE_SA_INIT:
1177                         return get_nonce(message, &this->my_nonce);
1178                 case CREATE_CHILD_SA:
1179                         if (generate_nonce(this) != SUCCESS)
1180                         {
1181                                 message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN,
1182                                                                         chunk_empty);
1183                                 return SUCCESS;
1184                         }
1185                         no_dh = FALSE;
1186                         break;
1187                 case IKE_AUTH:
1188                         if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1189                         {       /* wait until all authentication round completed */
1190                                 return NEED_MORE;
1191                         }
1192                         ike_auth = TRUE;
1193                 default:
1194                         break;
1195         }
1196
1197         if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
1198         {
1199                 DBG1(DBG_IKE, "unable to create CHILD_SA while rekeying IKE_SA");
1200                 message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
1201                 return SUCCESS;
1202         }
1203         if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
1204         {
1205                 DBG1(DBG_IKE, "unable to create CHILD_SA while deleting IKE_SA");
1206                 message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
1207                 return SUCCESS;
1208         }
1209
1210         if (this->config == NULL)
1211         {
1212                 this->config = select_child_cfg(this);
1213         }
1214         if (this->config == NULL)
1215         {
1216                 DBG1(DBG_IKE, "traffic selectors %#R=== %#R inacceptable",
1217                          this->tsr, this->tsi);
1218                 charon->bus->alert(charon->bus, ALERT_TS_MISMATCH, this->tsi, this->tsr);
1219                 message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1220                 handle_child_sa_failure(this, message);
1221                 return SUCCESS;
1222         }
1223
1224         /* check if ike_config_t included non-critical error notifies */
1225         enumerator = message->create_payload_enumerator(message);
1226         while (enumerator->enumerate(enumerator, &payload))
1227         {
1228                 if (payload->get_type(payload) == PLV2_NOTIFY)
1229                 {
1230                         notify_payload_t *notify = (notify_payload_t*)payload;
1231
1232                         switch (notify->get_notify_type(notify))
1233                         {
1234                                 case INTERNAL_ADDRESS_FAILURE:
1235                                 case FAILED_CP_REQUIRED:
1236                                 {
1237                                         DBG1(DBG_IKE,"configuration payload negotiation "
1238                                                  "failed, no CHILD_SA built");
1239                                         enumerator->destroy(enumerator);
1240                                         handle_child_sa_failure(this, message);
1241                                         return SUCCESS;
1242                                 }
1243                                 default:
1244                                         break;
1245                         }
1246                 }
1247         }
1248         enumerator->destroy(enumerator);
1249
1250         this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
1251                         this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
1252                         this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY),
1253                         this->mark_in, this->mark_out);
1254
1255         if (this->ipcomp_received != IPCOMP_NONE)
1256         {
1257                 if (this->config->use_ipcomp(this->config))
1258                 {
1259                         add_ipcomp_notify(this, message, this->ipcomp_received);
1260                 }
1261                 else
1262                 {
1263                         DBG1(DBG_IKE, "received %N notify but IPComp is disabled, ignoring",
1264                                  notify_type_names, IPCOMP_SUPPORTED);
1265                 }
1266         }
1267
1268         switch (select_and_install(this, no_dh, ike_auth))
1269         {
1270                 case SUCCESS:
1271                         break;
1272                 case NOT_FOUND:
1273                         message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
1274                         handle_child_sa_failure(this, message);
1275                         return SUCCESS;
1276                 case INVALID_ARG:
1277                 {
1278                         u_int16_t group = htons(this->dh_group);
1279                         message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
1280                                                                 chunk_from_thing(group));
1281                         handle_child_sa_failure(this, message);
1282                         return SUCCESS;
1283                 }
1284                 case FAILED:
1285                 default:
1286                         message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
1287                         handle_child_sa_failure(this, message);
1288                         return SUCCESS;
1289         }
1290
1291         build_payloads(this, message);
1292
1293         if (!this->rekey)
1294         {       /* invoke the child_up() hook if we are not rekeying */
1295                 charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1296         }
1297         return SUCCESS;
1298 }
1299
1300 /**
1301  * Raise alerts for received notify errors
1302  */
1303 static void raise_alerts(private_child_create_t *this, notify_type_t type)
1304 {
1305         linked_list_t *list;
1306
1307         switch (type)
1308         {
1309                 case NO_PROPOSAL_CHOSEN:
1310                         list = this->config->get_proposals(this->config, FALSE);
1311                         charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_CHILD, list);
1312                         list->destroy_offset(list, offsetof(proposal_t, destroy));
1313                         break;
1314                 default:
1315                         break;
1316         }
1317 }
1318
1319 METHOD(task_t, build_i_delete, status_t,
1320         private_child_create_t *this, message_t *message)
1321 {
1322         message->set_exchange_type(message, INFORMATIONAL);
1323         if (this->child_sa && this->proposal)
1324         {
1325                 protocol_id_t proto;
1326                 delete_payload_t *del;
1327                 u_int32_t spi;
1328
1329                 proto = this->proposal->get_protocol(this->proposal);
1330                 spi = this->child_sa->get_spi(this->child_sa, TRUE);
1331                 del = delete_payload_create(PLV2_DELETE, proto);
1332                 del->add_spi(del, spi);
1333                 message->add_payload(message, (payload_t*)del);
1334
1335                 DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
1336                          protocol_id_names, proto, ntohl(spi));
1337         }
1338         return NEED_MORE;
1339 }
1340
1341 /**
1342  * Change task to delete the failed CHILD_SA as initiator
1343  */
1344 static status_t delete_failed_sa(private_child_create_t *this)
1345 {
1346         this->public.task.build = _build_i_delete;
1347         this->public.task.process = (void*)return_success;
1348         return NEED_MORE;
1349 }
1350
1351 METHOD(task_t, process_i, status_t,
1352         private_child_create_t *this, message_t *message)
1353 {
1354         enumerator_t *enumerator;
1355         payload_t *payload;
1356         bool no_dh = TRUE, ike_auth = FALSE;
1357
1358         switch (message->get_exchange_type(message))
1359         {
1360                 case IKE_SA_INIT:
1361                         return get_nonce(message, &this->other_nonce);
1362                 case CREATE_CHILD_SA:
1363                         get_nonce(message, &this->other_nonce);
1364                         no_dh = FALSE;
1365                         break;
1366                 case IKE_AUTH:
1367                         if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
1368                         {       /* wait until all authentication round completed */
1369                                 return NEED_MORE;
1370                         }
1371                         ike_auth = TRUE;
1372                 default:
1373                         break;
1374         }
1375
1376         /* check for erroneous notifies */
1377         enumerator = message->create_payload_enumerator(message);
1378         while (enumerator->enumerate(enumerator, &payload))
1379         {
1380                 if (payload->get_type(payload) == PLV2_NOTIFY)
1381                 {
1382                         notify_payload_t *notify = (notify_payload_t*)payload;
1383                         notify_type_t type = notify->get_notify_type(notify);
1384
1385                         switch (type)
1386                         {
1387                                 /* handle notify errors related to CHILD_SA only */
1388                                 case NO_PROPOSAL_CHOSEN:
1389                                 case SINGLE_PAIR_REQUIRED:
1390                                 case NO_ADDITIONAL_SAS:
1391                                 case INTERNAL_ADDRESS_FAILURE:
1392                                 case FAILED_CP_REQUIRED:
1393                                 case TS_UNACCEPTABLE:
1394                                 case INVALID_SELECTORS:
1395                                 {
1396                                         DBG1(DBG_IKE, "received %N notify, no CHILD_SA built",
1397                                                  notify_type_names, type);
1398                                         enumerator->destroy(enumerator);
1399                                         raise_alerts(this, type);
1400                                         handle_child_sa_failure(this, message);
1401                                         /* an error in CHILD_SA creation is not critical */
1402                                         return SUCCESS;
1403                                 }
1404                                 case INVALID_KE_PAYLOAD:
1405                                 {
1406                                         chunk_t data;
1407                                         u_int16_t group = MODP_NONE;
1408
1409                                         data = notify->get_notification_data(notify);
1410                                         if (data.len == sizeof(group))
1411                                         {
1412                                                 memcpy(&group, data.ptr, data.len);
1413                                                 group = ntohs(group);
1414                                         }
1415                                         DBG1(DBG_IKE, "peer didn't accept DH group %N, "
1416                                                  "it requested %N", diffie_hellman_group_names,
1417                                                  this->dh_group, diffie_hellman_group_names, group);
1418                                         this->retry = TRUE;
1419                                         this->dh_group = group;
1420                                         this->child_sa->set_state(this->child_sa, CHILD_RETRYING);
1421                                         this->public.task.migrate(&this->public.task, this->ike_sa);
1422                                         enumerator->destroy(enumerator);
1423                                         return NEED_MORE;
1424                                 }
1425                                 default:
1426                                 {
1427                                         if (message->get_exchange_type(message) == CREATE_CHILD_SA)
1428                                         {       /* handle notifies if not handled in IKE_AUTH */
1429                                                 if (type <= 16383)
1430                                                 {
1431                                                         DBG1(DBG_IKE, "received %N notify error",
1432                                                                  notify_type_names, type);
1433                                                         enumerator->destroy(enumerator);
1434                                                         return SUCCESS;
1435                                                 }
1436                                                 DBG2(DBG_IKE, "received %N notify",
1437                                                          notify_type_names, type);
1438                                         }
1439                                         break;
1440                                 }
1441                         }
1442                 }
1443         }
1444         enumerator->destroy(enumerator);
1445
1446         process_payloads(this, message);
1447
1448         if (this->ipcomp == IPCOMP_NONE && this->ipcomp_received != IPCOMP_NONE)
1449         {
1450                 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify without requesting"
1451                          " one, no CHILD_SA built");
1452                 handle_child_sa_failure(this, message);
1453                 return delete_failed_sa(this);
1454         }
1455         else if (this->ipcomp != IPCOMP_NONE && this->ipcomp_received == IPCOMP_NONE)
1456         {
1457                 DBG1(DBG_IKE, "peer didn't accept our proposed IPComp transforms, "
1458                          "IPComp is disabled");
1459                 this->ipcomp = IPCOMP_NONE;
1460         }
1461         else if (this->ipcomp != IPCOMP_NONE && this->ipcomp != this->ipcomp_received)
1462         {
1463                 DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify we didn't propose, "
1464                          "no CHILD_SA built");
1465                 handle_child_sa_failure(this, message);
1466                 return delete_failed_sa(this);
1467         }
1468
1469         if (select_and_install(this, no_dh, ike_auth) == SUCCESS)
1470         {
1471                 if (!this->rekey)
1472                 {       /* invoke the child_up() hook if we are not rekeying */
1473                         charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
1474                 }
1475         }
1476         else
1477         {
1478                 handle_child_sa_failure(this, message);
1479                 return delete_failed_sa(this);
1480         }
1481         return SUCCESS;
1482 }
1483
1484 METHOD(child_create_t, use_reqid, void,
1485         private_child_create_t *this, u_int32_t reqid)
1486 {
1487         this->reqid = reqid;
1488 }
1489
1490 METHOD(child_create_t, use_marks, void,
1491         private_child_create_t *this, u_int in, u_int out)
1492 {
1493         this->mark_in = in;
1494         this->mark_out = out;
1495 }
1496
1497 METHOD(child_create_t, get_child, child_sa_t*,
1498         private_child_create_t *this)
1499 {
1500         return this->child_sa;
1501 }
1502
1503 METHOD(child_create_t, set_config, void,
1504         private_child_create_t *this, child_cfg_t *cfg)
1505 {
1506         DESTROY_IF(this->config);
1507         this->config = cfg;
1508 }
1509
1510 METHOD(child_create_t, get_lower_nonce, chunk_t,
1511         private_child_create_t *this)
1512 {
1513         if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
1514                            min(this->my_nonce.len, this->other_nonce.len)) < 0)
1515         {
1516                 return this->my_nonce;
1517         }
1518         else
1519         {
1520                 return this->other_nonce;
1521         }
1522 }
1523
1524 METHOD(task_t, get_type, task_type_t,
1525         private_child_create_t *this)
1526 {
1527         return TASK_CHILD_CREATE;
1528 }
1529
1530 METHOD(task_t, migrate, void,
1531         private_child_create_t *this, ike_sa_t *ike_sa)
1532 {
1533         chunk_free(&this->my_nonce);
1534         chunk_free(&this->other_nonce);
1535         if (this->tsr)
1536         {
1537                 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1538         }
1539         if (this->tsi)
1540         {
1541                 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1542         }
1543         DESTROY_IF(this->child_sa);
1544         DESTROY_IF(this->proposal);
1545         DESTROY_IF(this->dh);
1546         if (this->proposals)
1547         {
1548                 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1549         }
1550
1551         this->ike_sa = ike_sa;
1552         this->keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa);
1553         this->proposal = NULL;
1554         this->proposals = NULL;
1555         this->tsi = NULL;
1556         this->tsr = NULL;
1557         this->dh = NULL;
1558         this->child_sa = NULL;
1559         this->mode = MODE_TUNNEL;
1560         this->ipcomp = IPCOMP_NONE;
1561         this->ipcomp_received = IPCOMP_NONE;
1562         this->other_cpi = 0;
1563         this->reqid = 0;
1564         this->mark_in = 0;
1565         this->mark_out = 0;
1566         this->established = FALSE;
1567 }
1568
1569 METHOD(task_t, destroy, void,
1570         private_child_create_t *this)
1571 {
1572         chunk_free(&this->my_nonce);
1573         chunk_free(&this->other_nonce);
1574         if (this->tsr)
1575         {
1576                 this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
1577         }
1578         if (this->tsi)
1579         {
1580                 this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
1581         }
1582         if (!this->established)
1583         {
1584                 DESTROY_IF(this->child_sa);
1585         }
1586         DESTROY_IF(this->packet_tsi);
1587         DESTROY_IF(this->packet_tsr);
1588         DESTROY_IF(this->proposal);
1589         DESTROY_IF(this->dh);
1590         if (this->proposals)
1591         {
1592                 this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
1593         }
1594
1595         DESTROY_IF(this->config);
1596         free(this);
1597 }
1598
1599 /*
1600  * Described in header.
1601  */
1602 child_create_t *child_create_create(ike_sa_t *ike_sa,
1603                                                         child_cfg_t *config, bool rekey,
1604                                                         traffic_selector_t *tsi, traffic_selector_t *tsr)
1605 {
1606         private_child_create_t *this;
1607
1608         INIT(this,
1609                 .public = {
1610                         .get_child = _get_child,
1611                         .set_config = _set_config,
1612                         .get_lower_nonce = _get_lower_nonce,
1613                         .use_reqid = _use_reqid,
1614                         .use_marks = _use_marks,
1615                         .task = {
1616                                 .get_type = _get_type,
1617                                 .migrate = _migrate,
1618                                 .destroy = _destroy,
1619                         },
1620                 },
1621                 .ike_sa = ike_sa,
1622                 .config = config,
1623                 .packet_tsi = tsi ? tsi->clone(tsi) : NULL,
1624                 .packet_tsr = tsr ? tsr->clone(tsr) : NULL,
1625                 .dh_group = MODP_NONE,
1626                 .keymat = (keymat_v2_t*)ike_sa->get_keymat(ike_sa),
1627                 .mode = MODE_TUNNEL,
1628                 .tfcv3 = TRUE,
1629                 .ipcomp = IPCOMP_NONE,
1630                 .ipcomp_received = IPCOMP_NONE,
1631                 .rekey = rekey,
1632                 .retry = FALSE,
1633         );
1634
1635         if (config)
1636         {
1637                 this->public.task.build = _build_i;
1638                 this->public.task.process = _process_i;
1639                 this->initiator = TRUE;
1640         }
1641         else
1642         {
1643                 this->public.task.build = _build_r;
1644                 this->public.task.process = _process_r;
1645                 this->initiator = FALSE;
1646         }
1647
1648         return &this->public;
1649 }